Confidentiality and HIPAA for RBTs: Real Situations

Nobody violates confidentiality by publishing a client file. They violate it by saying a first name in a waiting room, texting a coworker from a parking lot, or answering a well-meaning question from a family friend.

Confidentiality in ABA fails in ordinary moments, which is why the rules are worth knowing at the level of daily habits rather than policy language.

What counts as protected information

More than you would guess. Protected health information includes anything that identifies a person and relates to their care:

• Name, address, phone number, email
• Dates of birth, service, admission
• Photographs and video
• Diagnosis, program content, and progress data
• The mere fact that someone is a client

That last item is the one people miss. Confirming that a person receives services is itself a disclosure — even if you say nothing else about them.

Also: de-identified is harder than it sounds. "A four-year-old in the blue house on Maple with the therapy dog" identifies someone perfectly well without a name.

Where it actually breaks down

The vague-post trap

"Had such a hard day with a kiddo today, but that breakthrough at the end 💙"

No name. Feels safe. It is not. Between your employer being listed on your profile, your location, the timing, and the specific detail, families in a small community can and do identify the child. Colleagues have lost jobs over posts less specific than this.

The workable rule: do not post about work at all. Not vaguely, not positively, not with permission from a parent — permission for a social post is not the same as informed consent for disclosure, and your agency almost certainly prohibits it regardless.

Session notes and documentation

Documentation is where confidentiality and professionalism overlap:

• Write objectively; adjectives about a child's character are both unprofessional and potentially damaging if the record is ever read by the family or in a legal context. It usually can be.
• Do not name other clients in a note. If a peer interaction is relevant, refer to "a peer."
• Never store notes on personal devices, personal cloud accounts, or in personal email.
• Complete notes in the approved system, on time. Late notes get reconstructed, and reconstructed notes are less accurate.

Assume everything you write will eventually be read by the parent, your supervisor, and possibly an attorney. Write accordingly — that standard produces better documentation anyway.

When disclosure is permitted

You may share protected information:

• With the treatment team, for the purpose of treatment
• With the parent or legal guardian, within your scope — session content yes, clinical interpretation to the supervisor
• Where a signed release exists, to the parties it names
• Where the law requires it, most notably mandated reporting

Two boundaries inside those permissions:

"Minimum necessary." Share what is required for the purpose, not everything you know. A school team coordinating a transition plan does not need the family's financial situation.

A release is specific. A release authorizing communication with a pediatrician does not authorize communication with a grandparent, a school, or another provider.

Mandated reporting

If you suspect abuse or neglect, confidentiality does not shield the information. As a mandated reporter you are obligated to report, and that obligation:

• Belongs to you personally, not to your agency
• Is based on reasonable suspicion, not proof
• Is not satisfied by telling your supervisor alone unless your jurisdiction and policy specify that route

Tell your supervisor, yes — and confirm that a report is made. If it is not, make it yourself. "I told my supervisor and assumed they handled it" is not a defense in most jurisdictions.

Document what you observed factually, immediately, and without interpretation.

A five-second test

Before you say, send, or post anything about work, ask: Would I be comfortable if this client's parent, my supervisor, and a compliance officer all saw this exactly as written?

If there is any hesitation, do not.

Practical habits that prevent nearly everything

• Lock your phone and laptop with a passcode and short auto-lock
• Never use personal messaging apps for client information
• Never photograph a client, a data sheet, or a program on a personal device
• Say initials, not names, in any space you do not control
• Turn documents face down when you step away
• Keep work accounts and personal accounts fully separate
• When asked about your work socially, describe the role, never the people

If a breach happens

Report it immediately. Same day.

The instinct to hope it goes unnoticed is understandable and always makes it worse. Prompt self-reporting is treated very differently from a breach discovered later, both by employers and by regulators. Document what happened, what information was involved, who was affected, and what you did.

One accidental disclosure reported immediately is a manageable incident. The same disclosure concealed for a month is a career problem.